Microsoft Edge: Building a safer browser • Hacker News Board

Re: Microsoft Edge: Building a safer browser

#61

Post by comex » Tue, May 12, 2015, 3:24 AM UTC

eropple wrote: post #34

integraton wrote: post #25

Earlier quoted context omitted.

Chrome doesn't use WebKit, it uses Blink, a fork of WebKit. I'm only referring to WebKit, the Apple open source browser project that builds and works on every major operating system including Windows. If you also want to talk about Blink, Google's browser project that, unlike IE/Spartan/Edge, also works on every major operating system, then that's fine, too. While we are at it, let's talk about Mozilla's browser and…

> Chrome doesn't use WebKit, it uses Blink, a fork of WebKit. Chrome didn't render the same as Safari when Chrome used WebKit, either. You're caping up for this, and I can't for the life of me figure out why.

To be fair, Chrome certainly behaved (behaves) more similar to Safari than to browsers with completely unrelated engines.

Re: Microsoft Edge: Building a safer browser

#62

Post by azakai » Tue, May 12, 2015, 3:27 AM UTC

Osiris wrote: post #50

JustSomeNobody wrote: post #45

Earlier quoted context omitted.

I thought they started with IE and cut out parts. That's not ground up.

> But Microsoft Edge has done more than just re-write the rendering engine... > Microsoft Edge hosts a new rendering engine, Microsoft EdgeHTML > The largest change in Microsoft Edge security is that the new browser is a Universal Windows app. Everything they'd said in their press releases, including this one, says that the browser is a completely rewrite from scratch, though leveraging lessons learned on security. e…

Actually, the information said that they forked their existing rendering engine, and started to remove all the cruft they didn't care about any more. That led to a lot of new code and faster development - but it isn't entirely from scratch.

edit: See for example http://en.wikipedia.org/wiki/EdgeHTML that mentions it beginning as a fork of Trident.

Re: Microsoft Edge: Building a safer browser

#63

Post by Osiris » Tue, May 12, 2015, 4:21 AM UTC

azakai wrote: post #62

Osiris wrote: post #50

Earlier quoted context omitted.

> But Microsoft Edge has done more than just re-write the rendering engine... > Microsoft Edge hosts a new rendering engine, Microsoft EdgeHTML > The largest change in Microsoft Edge security is that the new browser is a Universal Windows app. Everything they'd said in their press releases, including this one, says that the browser is a completely rewrite from scratch, though leveraging lessons learned on security. e…

Actually, the information said that they forked their existing rendering engine, and started to remove all the cruft they didn't care about any more. That led to a lot of new code and faster development - but it isn't entirely from scratch. edit: See for example http://en.wikipedia.org/wiki/EdgeHTML that mentions it beginning as a fork of Trident.

Thanks for the correction.

Re: Microsoft Edge: Building a safer browser

#64

Post by plorkyeran » Tue, May 12, 2015, 4:41 AM UTC

aikinai wrote: post #52

Osiris wrote: post #51

Earlier quoted context omitted.

I'm not surprised. It's clear they are using newer Windows APIs to offload 2D and 3D rendering among other things. I doubt they'd be able to release a version that didn't run on Windows for those reasons, just like Safari will never run on anything but OS X because it leverages OS X APIs.

Safari did run on Windows for years. But it did seem like they ported a lot of OS X libraries to Windows just to get it working. If I remember correctly, it had OS X font rendering for example.

iTunes for Windows also takes the same approach of porting the OS X libraries rather than porting the application. It's always kinda weird stumbling across Windows-specific code in the source to things like CoreFoundation.

Re: Microsoft Edge: Building a safer browser

#65

Post by wfh » Tue, May 12, 2015, 5:42 AM UTC

comex wrote: post #8

> MemGC (Memory Garbage Collector) is a memory garbage collection system that seeks to defend the browser from UAF (Use-after-free) vulnerabilities by taking responsibility for freeing memory away from the programmer and instead automating it, only freeing memory when the automation has detected that there are no more references left pointing to a given block of memory. Interesting; I don't think this has been announ…

This is not just "delay free", which is already in IE?

http://blog.trendmicro.com/trendlabs-security-intelligence/m...

Re: Microsoft Edge: Building a safer browser

#66

Post by eropple » Tue, May 12, 2015, 5:47 AM UTC

comex wrote: post #61

eropple wrote: post #34

Earlier quoted context omitted.

> Chrome doesn't use WebKit, it uses Blink, a fork of WebKit. Chrome didn't render the same as Safari when Chrome used WebKit, either. You're caping up for this, and I can't for the life of me figure out why.

To be fair, Chrome certainly behaved (behaves) more similar to Safari than to browsers with completely unrelated engines.

Only to a point. Font rendering, in particular, was significantly different between the two, even Windows/Windows and Mac/Mac. It was enough to make life difficult.

Re: Microsoft Edge: Building a safer browser

#67

Post by yohui » Tue, May 12, 2015, 5:49 AM UTC

adventured wrote: post #43

Turing_Machine wrote: post #27

Earlier quoted context omitted.

"I wonder how many average joes have written off IE?" Lots of them. Many surveys show it down in the Safari region, for instance: http://gs.statcounter.com/#all-browser-ww-monthly-201504-201...

More likely closer to 25% to 30% Every other major source than that one reports IE well above 12% http://www.zdnet.com/article/the-most-u-s-popular-web-browse... https://www.netmarketshare.com/browser-market-share.aspx?qpr...

No, NetMarketShare/NetApplications is the exception: https://en.wikipedia.org/wiki/Usage_share_of_web_browsers

Of course, they're also the only source that tries to count "unique visitors" rather than traffic, and uses country-level weighting to attempt to correct for sampling bias.

But personally, I still find StatCounter more useful.

Re: Microsoft Edge: Building a safer browser

#68

Post by wtallis » Tue, May 12, 2015, 5:59 AM UTC

johnwfinigan wrote: post #49

"Microsoft Edge is also 64-bit, not just by default, but at all times when running on a 64-bit processor." After 32-bit Windows Server went away as of 2008 R2, I didn't expect MS to keep shipping 32-bit client for this long. Anybody have a convincing argument as to why? 16-bit legacy apps in large businesses? Obviously it's not free to do this, especially since they'll be producing every patch for two PC platforms fo…

Drivers would be the only justification. If they really cared about 16-bit apps they would have supported them on 64-bit Windows: it's only real mode and virtual 8086 mode that are hard to support on a 64-bit OS; 64-bit compatibility mode can handle 16-bit protected mode software just as easily as 32-bit software. Additionally, virtualization works fine for application-level code, but not drivers.

Re: Microsoft Edge: Building a safer browser

#69

Post by zvrba » Tue, May 12, 2015, 6:09 AM UTC

johnwfinigan wrote: post #49

"Microsoft Edge is also 64-bit, not just by default, but at all times when running on a 64-bit processor." After 32-bit Windows Server went away as of 2008 R2, I didn't expect MS to keep shipping 32-bit client for this long. Anybody have a convincing argument as to why? 16-bit legacy apps in large businesses? Obviously it's not free to do this, especially since they'll be producing every patch for two PC platforms fo…

My guess: compatibility with existing ActiveX and BHO plugins.

Re: Microsoft Edge: Building a safer browser

#70

Post by lazaroclapp » Tue, May 12, 2015, 6:12 AM UTC

azakai wrote: post #62

Osiris wrote: post #50

Earlier quoted context omitted.

> But Microsoft Edge has done more than just re-write the rendering engine... > Microsoft Edge hosts a new rendering engine, Microsoft EdgeHTML > The largest change in Microsoft Edge security is that the new browser is a Universal Windows app. Everything they'd said in their press releases, including this one, says that the browser is a completely rewrite from scratch, though leveraging lessons learned on security. e…

Actually, the information said that they forked their existing rendering engine, and started to remove all the cruft they didn't care about any more. That led to a lot of new code and faster development - but it isn't entirely from scratch. edit: See for example http://en.wikipedia.org/wiki/EdgeHTML that mentions it beginning as a fork of Trident.

True enough as far as it goes, but isn't that like saying that people running a current version of Firefox are still using code from the Netscape 4? A fork of Trident that is not afraid of deprecating unsafe features and breaking backwards-compatibility for the sake of standards-compatibility isn't necessarily a worse thing than a from-scratch-new rendering engine.